Access to the PPD SSH Bastion

Accounts on the PPD SSH bastion are separate from the standard PPD linux account and need to be requested from PPDITHelpdesk@stfc.ac.uk.

The Bastion host only supports ssh key authentication not passwords so you need to send us a copy of your public key. If you want to use ssh keys to log on to the PPD Linux machines or Windows Terminal Server please set up a separate key pair for that and use ssh-agent to manage them. We will occasionally compare authorized_key files.

Creating an ssh key pair.

ssh-keygen -t rsa [-C "Comment"] [-f output_keyfile] 

if you don't supply the "-f output_keyfile" this prompt you for the files to create, the default being ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub. It will then prompt you for a passphrase to encrypt you private key, please choose a strong passphrase.

If you are logging in from a linux or OSX desktop/laptop you may be able to run ssh-add to load up your new ssh key into an "agent" that will save you having to enter the passphrase every time you log in. Instructions for using the ssh agent with PuTTY on the PPD Windows desktops can be found here.

Logging onto the PPD SSH Bastion

ssh [-i private_keyfile] <username>@&voyager.pp.rl.ac.uk 

If your ssh-keyfile is in the standard location or you are using an agent you can omit the -i option.

This will present you with a normal bash shell on the bastion host, from there you can ssh on to the PPD Linux systems or Windows Terminal Server. The home area is local to the bastion host but your PPD linux home area is available under /home/ppd/<username>.

If you use ssh-agent a useful way of simplifying this is to add the following section to your .ssh/config file

Host voyager
   Hostname              voyager.pp.rl.ac.uk
   ForwardAgent          yes
   ForwardX11            yes
   ControlMaster         auto
   ControlPath           /tmp/%r@%h:%p
   ServerAliveInterval   15
   ServerAliveCountMax   3
   ProxyCommand          none

Then create an alias such as:

alias bssh='ssh -o "ProxyCommand = ssh <your-bastion-username>@voyager nc %h %p 2> /dev/null"'

That will allow you to run bssh <host> to log into one of the PPD machines.

This also works with scp so you can also define:

alias bscp='scp -o "ProxyCommand = ssh <your-bastion-username>@voyager nc %h %p 2> /dev/null”’

In Windows you can achieve the same first follow the SSHPUTTY instructions to set up pagent and make sure you can log into both voyager and the final target from RAL without needing a passphrase.

Then open the config to log into your target machine and open the Connection -> Proxy tab and set:

• Proxy type: Local
• Proxy hostname: voyager.pp.rl.ac.uk
• Port: 22
• Telnet command, or local proxy command: plink.exe -agent -l <username> %proxyhost -nc %host:%port

Save the config as target via voyager and test, you should get a login on your target machine.

-- ChrisBrew - 2013-11-09